AML Training Requirements for Fintechs: What the BSA Requires

Annual AML training is one of the four original pillars of BSA compliance — required from the beginning alongside internal controls, a designated compliance officer, and independent testing. It is also one of the most commonly inadequate elements of fintech compliance programs, with many companies treating it as a formality rather than a genuine compliance requirement.

The Legal Basis for AML Training

The BSA requires covered financial institutions to provide ongoing employee training as part of their AML program. FinCEN's implementing regulations specify that the training program must train employees in their specific responsibilities for detecting and reporting potential money laundering activity.

This training requirement is a program element — meaning it is assessed by examiners as part of the overall AML program evaluation. Inadequate training is not just a human resources deficiency — it is a compliance program deficiency with examination and enforcement implications.

Who Must Be Trained

The training requirement applies to employees in functions relevant to the detection and reporting of potential money laundering. This is broader than it might seem.

Customer-facing staff — customer service, account management, and sales staff — must be trained to recognize and escalate suspicious customer behavior, understand the SAR confidentiality rule, and know what to say when customers ask about compliance-related account actions.

Operations staff — payment processing, account operations, and transaction handling teams — must understand what constitutes suspicious activity in their specific function and how to escalate concerns.

Compliance staff — the BSA Officer and compliance analysts — require the most comprehensive training covering all aspects of BSA requirements, SAR investigation procedures, and compliance program management.

Senior management — executives and the board of directors or equivalent governing body — need to understand their compliance oversight responsibilities and the risks associated with BSA program failures.

What Training Must Cover

Training content must be appropriate for the specific role being trained — role-specific training is more effective than uniform training delivered identically to all staff.

For all relevant staff, training should cover the basics of what money laundering is and why it is a regulatory concern, what indicators of suspicious activity look like in their specific role, how to escalate concerns to the compliance team, and the SAR confidentiality rule and what tipping off means.

For compliance staff, training should additionally cover specific BSA requirements, SAR filing procedures and deadlines, transaction monitoring alert review, and current regulatory developments affecting your business type. Familiarity with common AML red flags is essential for staff responsible for alert review and investigations.

Frequency Requirements

Annual training is the minimum requirement for most covered institutions. New hire training — before employees begin performing compliance-relevant functions — is also required. Updates to training content are required when regulations change, when your compliance policies change, or when significant compliance events indicate gaps in staff knowledge.

Documentation Requirements

Training completion must be documented. Records should identify who received training, when the training occurred, what the training covered, and how completion was confirmed — whether through attendance records, assessment scores, or electronic acknowledgment.

These records must be retained consistent with BSA recordkeeping requirements — five years from the date of the record — and must be retrievable for examination on reasonable notice.

Common Training Failures

Delivering identical training to all employees regardless of role — not meeting the role-specific requirement. Training once at hire but never refreshing. Documenting completion informally — verbal acknowledgment or undocumented attendance — rather than maintaining retrievable records. Using generic training materials that do not reflect your specific compliance program or business model.

Frequently Asked Questions

Does online AML training satisfy the BSA training requirement?

Yes — online training can satisfy the BSA training requirement provided it covers the required content, is role-specific, and completion is documented. Many fintech companies use a combination of online modules for broad staff training and more specialized in-person or live training for compliance staff.

Does annual training need to be a single session?

No. Annual training can be delivered in multiple sessions, modules, or formats throughout the year. What matters is that all required training is delivered within the annual cycle and that completion is documented.

How ComplyOne Helps

ComplyOne helps fintechs develop AML training programs that satisfy BSA requirements — from curriculum design and delivery through documentation and record keeping — through advisory services and compliance support.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.